What Data Should You Use to Measure Human Cyber Risk?

Human Risk Management has acquired a very modern problem: we have more data than ever and still have to work out what any of it means.

Learning platforms know who completed training and how they performed. Phishing platforms record clicks, credential submissions and reports. Identity systems know about access, authentication and privilege. Email security, SIEM, DLP and other security tools generate streams of events involving people. Assessments and surveys can add evidence about capability, confidence, behavior and culture. Workforce systems provide role and organizational context.

All of those sources can contribute to human cyber risk measurement.

None of them arrives pre-interpreted as human risk.

That distinction matters. The best human risk measurement programs combine several kinds of evidence, but they select and interpret that evidence according to the risk questions the organization is actually trying to answer. More telemetry can improve visibility. It does not automatically improve understanding.

For the wider measurement architecture, our guide to how to measure human cyber risk explains how organizations can move from isolated metrics toward signals, patterns, risk interpretation and measurable change. Cybermaniacs

What data can be used to measure human cyber risk?

Most organizations can potentially draw from several broad evidence families:

The temptation is to turn that list into a shopping list for integrations.

Resist it.

The fact that data exists does not mean it belongs in every human-risk model. The useful question is what evidence is needed to understand a particular condition, make a particular decision or evaluate a particular intervention.

Our guide on what Human Risk Management should actually measure makes the related distinction between program metrics, health measures, flow metrics, change measures, watch metrics and interpreted risk views. Different measurements have different jobs. Cybermaniacs

Learning and competency data still matter

Human Risk Management did not make awareness data obsolete.

Training completion is useful evidence that an assigned learning activity occurred. Assessment results can provide evidence about knowledge or competency. Learning behavior may show where populations struggle with particular concepts or how capability changes over time.

The problem begins when those measurements are asked to prove something they were never designed to prove.

A 98% completion rate can tell you that almost everybody completed the required activity. It cannot, by itself, establish that people will recognize a convincing business email compromise attempt three months later, handle sensitive information appropriately during a rushed project, challenge an unusual payment request from a senior executive or report a mistake quickly enough to limit damage.

That is a measurement-boundary problem, not an argument against training metrics.

Useful Human Risk Management preserves the distinction between program activity, capability, behavior and risk outcomes rather than collapsing them into one success measure.

Phishing and social-engineering data provide behavioral evidence

Phishing simulations remain one of the few places where many organizations can observe workforce behavior under a controlled security scenario. Clicks, credential submissions, message reporting and response timing can all provide useful evidence.

They also need context.

A 6% click rate in one simulation is not necessarily equivalent to a 6% click rate in another. Message difficulty, familiarity, targeting, timing and population characteristics can all affect the result.

NIST developed the NIST Phish Scale specifically to help practitioners account for the human detection difficulty of phishing simulations when interpreting results. That is a useful reminder of a wider measurement principle: the event is only one part of the evidence. Cybermaniacs

Reporting behavior can be equally important. An organization interested in resilience may care not only about whether somebody interacts with a suspicious message, but whether employees recognize uncertainty, escalate appropriately and help the organization detect a threat quickly.

Those are different questions. They require different measures.

Identity and access data can add exposure and behavioral context

Identity systems create another potentially valuable evidence layer.

Authentication patterns, account compromise, excessive privilege, risky sign-ins, access changes and unusual activity can all contribute to understanding workforce-related exposure. A person with extensive access to sensitive systems may represent a different potential consequence than someone performing similar behavior with very limited access.

That does not make privilege a measure of poor behavior.

It changes the risk context around the behavior.

This is an important distinction because human-risk analytics can become misleading very quickly when exposure, behavior and judgment are blended together. A highly privileged employee should not automatically acquire a worse behavioral diagnosis simply because the consequence of account compromise would be greater.

Good measurement preserves those distinctions long enough to make sensible decisions from them.

Email, DLP and security telemetry show what is happening in the environment

Security teams increasingly want Human Risk Management to consume real security telemetry rather than relying only on simulated behavior.

That makes sense.

Email security can reveal actual threat exposure. DLP can identify data-handling events. SIEM and UEBA systems can surface unusual activity. Incident-response systems can connect workforce behavior with confirmed events. Endpoint, collaboration and other security technologies can add further evidence where relevant.

This greatly improves observability.

It does not eliminate the need for interpretation.

A DLP event may indicate unsafe behavior. It may also reflect an unusual but legitimate workflow, a badly designed policy, a business process that encourages workarounds or an application being used in a way the control was not designed to understand.

Likewise, a risky sign-in can be important without telling you very much about the person's underlying security capability. A user may have been deceived, compromised technically, operating from an unusual location or simply caught by an imperfect detection rule.

The useful progression is therefore something closer to:

event → measure → signal → pattern → interpretation

rather than:

event → employee risk score

That extra analytical work is less flashy than adding another dashboard tile. It is also where much of the value sits.

Real incidents are powerful evidence, but they are not a complete measurement system

Confirmed incidents deserve substantial weight because they provide evidence from the real environment.

They can show which behaviors, workflows, populations, threats and controls actually contributed to an adverse outcome. Near misses and successful reporting can be equally valuable because they show where people or systems interrupted a potentially harmful sequence.

Incident data has an obvious limitation, though: serious security incidents are relatively sparse compared with the volume of ordinary workforce activity.

If you measure only what has already gone wrong, you risk building a system dominated by lagging evidence.

Human Risk Management therefore needs ways to combine real-world outcomes with evidence that helps identify changing conditions earlier: competency, reporting behavior, exposure, cultural conditions, repeated event patterns, assessment findings and other relevant indicators.

This is one reason our measurement approach separates different kinds of metrics instead of asking a single score to serve as both early-warning system and historical record.

Assessments can reveal what technical telemetry cannot see

Some of the most important human-risk conditions are difficult to infer reliably from security events.

A technical system may show that reporting behavior is low. It cannot necessarily tell you whether employees fail to recognize threats, lack confidence, distrust the reporting process, fear consequences for getting something wrong, believe nobody responds to reports or simply find the workflow irritating enough to avoid it.

Those are different conditions.

They imply different interventions.

Assessment can add evidence about areas such as competency, behavior, confidence, psychology, culture and organizational conditions. Qualitative evidence can also be valuable when an organization needs to understand why an observed pattern exists rather than simply confirm that it exists.

Cybermaniacs ASSURE Human Risk Assessment is designed around that diagnostic problem: establishing a deeper human-risk baseline and helping organizations understand differences across behavior, perception, culture and organizational context rather than relying only on surface-level program metrics. Cybermaniacs

The objective is not to replace operational telemetry with surveys.

It is to use different forms of evidence for the questions they are actually capable of answering.

Workforce context can change the meaning of the evidence

Imagine two employees perform the same apparently risky action.

One works in finance and has privileged access to payment systems. The other has little access to sensitive systems. One operates in a workflow where the organization has provided an approved alternative. The other works in a process where completing the task without a workaround is practically impossible.

The event may be identical.

The risk story is not.

Role, access, function, geography, workflow, organizational structure and other contextual information can help security teams understand where exposure exists and why patterns vary between populations.

Context also protects against one of the least useful outcomes in Human Risk Management: turning every event into a judgment about the person involved.

The purpose of measurement is to understand conditions well enough to manage them. Sometimes the employee is the most important unit of analysis. Sometimes the useful answer exists at the role, team, business unit, workflow or organizational level.

That decision should follow the risk question.

Culture and organizational conditions belong in the picture

Human behavior takes place inside an organization.

People respond to targets, deadlines, leadership signals, workload, processes, incentives, norms and the behavior of the people around them. A security team can spend years trying to correct an employee behavior that the organization itself quietly rewards every afternoon at 4:45.

That matters for measurement because an observed action can have more than one plausible cause.

If employees routinely bypass a security process, capability may be the problem. So may usability. Or workload. Or incentives. Or management expectations. Or a local norm that has become so established nobody even experiences it as a workaround anymore.

Security culture and organizational evidence help reveal some of those conditions.

They also stop Human Risk Management from becoming a sophisticated way of counting employee mistakes while leaving the system producing those mistakes conveniently out of frame.

AI is creating another human-risk data problem

Enterprise AI adoption is beginning to create a new family of workforce evidence.

Organizations may increasingly want to understand how employees use approved and unapproved AI systems, handle sensitive information in AI-enabled workflows, rely on generated outputs, supervise automated activity and respond when AI behaves unexpectedly.

Some of that evidence may come from technical systems.

Much of its meaning will still depend on human and organizational context.

The question “Did an employee use an AI tool?” is usually much less interesting than questions such as: what were they trying to accomplish, what authority did the tool have, what information was involved, how much judgment was delegated, what verification occurred and what happened when something did not look right?

The arrival of richer AI telemetry therefore makes disciplined human-risk interpretation more important, rather than less.

For a deeper treatment of the data problem at the intelligence layer, see What Data Does Workforce Risk Intelligence Actually Need?. That article looks specifically at the point where connecting additional workforce and security data stops automatically producing better intelligence. Cybermaniacs

Data quality matters before analytical sophistication

There is another unglamorous problem worth confronting: enterprise data is messy.

Systems disagree. Definitions change. Data goes missing. Accounts are duplicated. Organizational structures lag behind reality. An event may be recorded in one system and corrected later in another. Populations may be too small for reliable comparison. Some measures may be frequent but weak; others may be strong but available only periodically.

A sophisticated human-risk model cannot make those limitations disappear.

In fact, sophisticated analytics make it more important to understand them.

NIST's current information-security measurement guidance in SP 800-55 Volume 1 emphasizes the design and selection of information-security measures, while SP 800-55 Volume 2 addresses the development of information-security measurement programs. The broader discipline is relevant here: measurement needs defined purposes, appropriate evidence, analysis, validation and an understanding of data quality and uncertainty rather than simply a growing collection of numbers. Cybermaniacs

Human Risk Management should be no different.

Confidence is part of the result.

Do you need all of these data sources?

No.

A useful Human Risk Management program does not need to connect everything it possibly can.

Start with the decisions you need to make.

If the immediate problem is understanding whether employees can recognize and respond to social-engineering threats, learning, assessment, phishing and reporting evidence may be enough to make meaningful progress.

If the problem is understanding where real data-handling risk exists, DLP, role, workflow and organizational evidence may become much more important.

If leadership wants a meaningful enterprise baseline, security telemetry alone may leave major questions about competency, culture, psychology and organizational conditions unanswered.

If the program is trying to determine whether a specific intervention worked, it needs evidence designed around the condition that intervention was intended to change.

The best measurement system is therefore rarely the one with the largest number of integrations.

It is the one that can answer the organization's important risk questions with sufficient, relevant and interpretable evidence.

From data to risk: what should happen in between?

This is the part of Human Risk Management that deserves more scrutiny.

Data is collected.

A defined measure gives some of it structure. Measures can contribute signals. Signals can form patterns. Those patterns may indicate a condition worth investigating. Context helps determine what that condition means. Evidence and confidence determine whether action is justified. An intervention changes something in the environment. Measurement then helps determine whether the relevant condition changed.

There are several analytical steps between “we observed something” and “we know this population is high risk.”

Good measurement makes those steps easier to understand.

Poor measurement hides them behind a score.

That distinction also explains why human risk scores need to be interpreted carefully. Cybermaniacs' measurement guidance treats a score as one possible analytical output whose usefulness depends on the evidence, assumptions and methodology underneath it. Cybermaniacs

How Cybermaniacs approaches human-risk data

Cybermaniacs approaches Human Risk Management as a connected measurement and intervention discipline.

That can involve learning and competency evidence, phishing and social-engineering behavior, assessment, psychology, culture, workforce and organizational context, security signals, intervention evidence and outcomes. The relevant combination depends on the organization and the problem being investigated.

We deliberately preserve the distinctions between the underlying evidence and the interpretation produced from it. An event is not automatically a diagnosis. A metric is not automatically a risk indicator. A score is not the risk itself. Correlation does not establish causality, and greater precision in a dashboard does not necessarily mean greater certainty about the condition being measured.

Behind that approach are deeper models, measurement methods, taxonomies and analytical structures developed for Human Risk Management. The internal mechanics remain part of the Cybermaniacs methodology. What buyers should expect to see is the result: a system capable of connecting different kinds of evidence without pretending they all mean the same thing.

The wider Cybermaniacs Human Risk Management Capability Map places this inside a broader operating capability spanning diagnosis, capability development, behavior and culture, evidence and context, measurement of risk and change, and continuous adaptation. Cybermaniacs

Because ultimately the reason to collect human-risk data is not to own more human-risk data.

It is to make better risk decisions.

Frequently asked questions

What data should be used to measure human cyber risk?

Useful evidence may include learning and competency data, phishing and social-engineering results, suspicious-message reporting, identity and access data, email security, DLP and other security events, incidents, human-risk assessments, culture evidence, workforce context and intervention outcomes. The appropriate mix depends on the risk question the organization needs to answer.

Is security telemetry enough to measure human risk?

Usually not on its own. Security telemetry can provide valuable evidence of activity, exposure and real-world events, but it may not explain the capability, motivation, culture, workflow or organizational conditions behind an observed pattern. Those questions may require additional evidence and interpretation.

Should training completion be included in human-risk measurement?

Yes, when it is used for the right purpose. Completion is useful evidence about program delivery and participation. It should not be treated by itself as evidence that behavior changed or enterprise cyber risk declined.

Are phishing simulations useful human-risk data?

Yes. Phishing simulations can provide controlled behavioral evidence about recognition, interaction and reporting. Results are more meaningful when message difficulty, population context, reporting behavior and trends over time are considered.

What workforce data is useful for Human Risk Management?

Role, function, access, organizational structure and other relevant workforce context can help explain exposure and differences between populations. Organizations should collect only information appropriate to the risk decision and apply suitable privacy, access and governance controls.

Does more data produce a better human risk score?

Not necessarily. Adding weak, redundant or poorly understood variables can make a score more complicated without making it more meaningful. Buyers should understand what each input contributes, why it is considered relevant and whether the underlying evidence can be investigated.

How should organizations start collecting human-risk data?

Begin with the risk questions and decisions the Human Risk Management program needs to support. Identify the evidence already available, determine where important gaps exist and add new sources when they materially improve understanding. Our guide to choosing a Human Risk Management platform provides a useful evaluation framework for organizations considering technology to connect those capabilities.